Re: [PATCH v8 06/15] iommufd/device: Hold a KVM file reference for the device lifetime

[sashiko-bot@kernel.org]

> The KVM file stored in an iommufd_device currently relies on the
> reference held by VFIO while the device is open. Normally, unbind waits
> for outstanding device references before VFIO drops its KVM reference.
> However, REMOVE_WAIT only waits for 60 seconds. If that timeout expires,
> the device object remains in the iommufd xarray.
> 
> For example, an IOMMU_GET_HW_INFO ioctl can hold a device reference while
> blocked on a userspace buffer fault:
> 
>   iommufd_fops_ioctl()
>     iommufd_get_hw_info()
>       iommufd_get_device()
>         iommufd_get_object()
>           iommufd_lock_obj()       /* takes users and wait_cnt refs */
>       copy_to_user() / clear_user() /* may block before putting refs */
> [ ... ]
> check in the destructor so that bind failure cleanup is covered too.
> Document the ownership in the bind API and device structure.
> 
> Fixes: d8bb80c8f0e5 ("iommufd/device: Associate KVM file pointer with iommufd_device")
> Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104161632.3547423-1-aneesh.kumar@kernel.org?part=6